{"id":"CVE-2022-47633","aliases":["GHSA-m3cq-xcx9-3gvm","BIT-kyverno-2022-47633","GO-2022-1180"],"title":"kyverno verifyImages rule bypass possible with malicious proxy/registry","summary":"kyverno verifyImages rule bypass possible with malicious proxy/registry","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","vendor":"kyverno","product":"github.com/kyverno/kyverno","ecosystem":"go","affected":["github.com/kyverno/kyverno >= 1.8.3, < 1.8.5"],"patched":["github.com/kyverno/kyverno 1.8.5"],"published":"2022-12-21","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-m3cq-xcx9-3gvm","references":[{"url":"https://github.com/kyverno/kyverno/security/advisories/GHSA-m3cq-xcx9-3gvm"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-47633"},{"url":"https://github.com/kyverno/kyverno/pull/5713"},{"url":"https://github.com/kyverno/kyverno"},{"url":"https://github.com/kyverno/kyverno/compare/v1.8.4...v1.8.5"},{"url":"https://github.com/kyverno/kyverno/releases/tag/v1.8.5"},{"url":"https://kyverno.io/docs/writing-policies/verify-images"},{"url":"https://kyverno.io/policies/best-practices/restrict_image_registries/restrict_image_registries"},{"url":"https://pkg.go.dev/vuln/GO-2022-1180"},{"url":"https://web.archive.org/web/20230426095744/https://kyverno.io/policies/best-practices/restrict_image_registries/restrict_image_registries"}],"tags":["osv","go"],"epss":0.00956,"epssPercentile":0.59932,"ingestedAt":"2026-07-09T18:56:36.602Z","slug":"CVE-2022-47633","body":"## Overview\n\n### Impact\n\nUsers of Kyverno on versions 1.8.3 or 1.8.4 who use `verifyImages` rules to verify container image signatures, and do not prevent use of unknown registries.\n\n### Patches\n\nThis issue has been fixed in version [1.8.5](https://github.com/kyverno/kyverno/releases/tag/v1.8.5)\n\n### Workarounds\n\nConfigure a Kyverno policy to restrict registries to a set of secure trusted image registries ([sample](https://kyverno.io/policies/best-practices/restrict_image_registries/restrict_image_registries/)).\n\n### References\n\n## Affected packages\n\n- `github.com/kyverno/kyverno >= 1.8.3, < 1.8.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/kyverno/kyverno 1.8.5`","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}